Security Confidential S7 E1 Ron Eddings

Manoj Tandon:
Hello everyone and welcome to another episode of Dark Rhino Security’s Security Confidential. Today we have an awesome guest with us. I’m really looking forward to this conversation. Ron Eddings joins us. Ron is a cybersecurity advocate, a creative director, and a podcast executive producer, so he should be at home on this show. Additionally, Ron really is the real thing when it comes to cybersecurity. He’s been a practitioner. He has worked as a security architect at notable firms like Demisto and Palo Alto Networks. He is currently the Creative Director at Axonius and is also the co-founder and executive producer of Hacker Valley Studios. Welcome to the show, Ron. Thank you so much for being here.

Ron Eddings:
Thank you for having me. A pleasure.

Manoj Tandon:
You know, it’s an honor in so many ways. You’re somewhat of a celebrity out there, so we get our own celebrity. That’s fantastic.

Ron Eddings:
There we go.

Manoj Tandon:
So let’s kick this off. It’s always interesting on people’s journeys as to how they got here, right? One of the things that I read when I was looking at your profile was that you describe yourself as a cybersecurity advocate. How did that happen? How did you become one?

Ron Eddings:
Before I answer this question, because this is such a “why” question—it is a big one though—do you want the long answer? We could abbreviate it a little bit.

Manoj Tandon:
I want the answer that you want to let our listeners know. Our aim is to make sure we have you for an hour and be respectful of that time, but we want you to tell our listeners what you want them to know about that because how you answer it may actually impact someone out there, and that would be the greatest thing in the world.

Ron Eddings:
Let’s try it out. So there’s two stories that are intertwined. The first story is how I got started in cybersecurity. It’s a long story, but we’ll abbreviate it a little bit. I would say that I’m a son of cybersecurity. Cybersecurity, to me, feels like family to some degree. It feels like a brother, and at some degree it feels like a mom or a dad because it’s provided me so much support when I was young. I was into sports and trying to be into technology, but I felt like I was on the middle of the fence. Some of my friends were really into sports, and I liked sports but I didn’t love it. Some of my friends were into other things like music, video, and audio, but I didn’t have anybody that really could connect with me on technology. I would linger and bring my friends into AOL chat rooms and we would talk crap to each other. We would talk about sports; we would talk about our lives.

Manoj Tandon:
Now you know that just dated you a whole bunch.

Ron Eddings:
Exactly. And one day we were talking crap in the chat room and I was talking crap to the wrong person. They sent me a file on AOL through a feature called Direct Message.

Manoj Tandon:
Shout out. I remember. I know that one well.

Ron Eddings:
So they sent me a file, and at this point I’m like 13 or 14. Of course I open it, and my CD-ROM drive starts opening and closing; my computer starts rebooting. Long story short, this person sent me a virus and the first thing I thought was, “I have to fix this because this is a family computer. If my mom finds out what happened, I’m in deep trouble.” So I went back into the room and I asked the guy, “Hey, how did you do that? Please tell me.” I bugged him and kept sending him messages. I felt more like one of these bots that he had than his own bots. He probably regretted this decision, but he did help me and he set me on a path.

Ultimately, I ran into a mentor when I was working at a public access channel. I just had this realization the other day that really my start in cybersecurity came from film. I was working at a public access channel and a gentleman walks in, and his name is Marcus Carey. He says, “Hey Ron, I see that you’re reading this book on CCNA. What do you think you know about IT and networking?” And I was like, “I do, but I’m a hacker.” And he thought it was hilarious.

Marcus has gone on to write many books; he wrote the Tribe of Hackers series, and he also gave me a roadmap on how to become great in the field. He said, “If you do these things—read these books, go get these certifications—you can create your own path. You don’t have to go to a traditional college or anything like that. You could make your own path.” This was the first advocate that I had in my life, from a personal perspective but also from a cyber perspective. As I started to make my way into the field, I worked at places like Booz Allen Hamilton as a consultant. You mentioned Demisto and Palo Alto Networks. I was working in customer success and I realized that my purpose isn’t necessarily to build tech from scratch; it’s to support those that are working in cybersecurity to be their best selves.

I love being a consultant, providing help where I can, running off after I’m not needed, and even doing that from a content perspective. I’ve spent the past 15 years of my life learning about cybersecurity. I thought it would be great if I spent the next 15 years teaching people about it, talking about it, and being an advocate for others that are working in the field.

Manoj Tandon:
That’s fantastic, and I love the fact that you encountered someone that was willing to guide you down a non-traditional path so you weren’t cluttered with all the formalities. You were able to pursue a passion. I gotta ask the question though, what was Marcus’s guidance like? What was his roadmap to greatness? Because you can’t say that and then not have me ask that question. Someone’s going to want to know: “What do I gotta read, man?”

Ron Eddings:
I was so lucky when I met Marcus. He walked into this public access studio and he wanted to do a bit on cybersecurity. It wasn’t just him; he brought in two other hallmark names. One of the people he brought in was Johnny Long. Johnny Long is a pioneer of Google hacking. He also brought in Joe McCray. Joe McCray is someone that has taught offensive tactics for quite some time. Both of these people, in addition to Marcus, all took me under their wing.

Marcus was telling me more about how to mature myself as a practitioner and really understand technology from a requirement level, but also understand it from, “Hey, everything is an API. You just need to learn how to understand an API; that’s a form of communication.” Joe’s thing was: become the baddest, most dangerous hacker that you can become. That was powerful to me as a youth—seeing someone that can break into computers, pop a shell, and also look cool while doing it. He’s a hilarious person, so he just made it look effortless.

Manoj Tandon:
Did he have any advice on good lawyers while you’re doing that?

Ron Eddings:
He told me about one great one called “Don’t Get Caught.”

Manoj Tandon:
That’s astute advice. But when you look at what Marcus was saying, he was trying to create a mindset there. What is that mindset? That mindset of a hacker, that mindset of someone that is pursuing a passion? What’s going on internally? Because I think that matters way more than the actual knowledge itself in many ways.

Ron Eddings:
Yeah. It’s been an evolution over the years. When I first was learning about technology and cybersecurity, it was “become the best.” I had an ego, and I wanted to make a lot of money doing it. And there’s nothing wrong with that—this is one of the clearest paths for wealth. My parents were very relaxed. They didn’t necessarily care about my grades or what I did after school; they just really made sure that I came home before dark and that I wasn’t acting like a nuisance or someone bad by nature. What I also learned when pursuing this thing called financial wealth is that financial wealth isn’t the only type of wealth. There’s also personal wealth, spiritual wealth, and physical wealth. I started to see that learning about cybersecurity is an auxiliary skill for me. When I learn more about cybersecurity, I learn about the world. I learn about offensive tactics and defensive tactics. There are a lot of military parallels, and there’s also a lot of chess involved.

Over the years, I’ve really been learning about the topics that can make me better at cybersecurity but aren’t necessarily cybersecurity-related. One example is that I just started doing Tai Chi. It’s all about moving your energy. It’s a way to have some physical movement and meditate. Using your energy in the right way is how you become a superhero; it’s how you tap into your superpower. If you’re able to tap into your superpower—and I can tell you that mine is providing strategic and tactical solutions for people to benefit from—these can be technology solutions, ideas, or even physical advice. If somebody wanted to know about working out, I’m always open to providing advice and feedback. Combining all of these skills over time has really been the fuel for my appetite for learning about cybersecurity and getting better at it day by day.

Manoj Tandon:
Let me ask you this: in what you’re describing—and I’m going to paraphrase here—is a deep passion to pursue excellence for the sake of excellence itself?

Ron Eddings:
That’s it.

Manoj Tandon:
I’m oversimplifying it, but it’s a very key thing. I think it applies to any topic in human endeavor. If you have that passion for the pursuit of something for the sake of it, and do it with excellence, would it not stand to say that you’ll get the physical wealth, you’ll get the mental wealth, you’ll get the knowledge wealth, but then the material wealth is just kind of an outcome of all of that?

Ron Eddings:
It’s a byproduct. It’s not the actual goal. If it’s pursued as a solitary goal, you may or may not have success. But if you for sure pursue it the way you’re describing it, you might have a natural outcome that surprises you. It’s all about your value system. If achieving materials is valuable to you, then whatever you’re doing that’s not achieving materials for you is going to feel painful. It’s going to feel like friction.

Over time, I had a lot of friction on this topic because what’s really important? Is it money? Is it career? Is it personal life? Is it friends? Is it family? Is it all of them combined? And what are the ratios? What I boiled it down to was my mission and vision for myself, and it’s to gain rare and valuable skills to acquire personal and financial freedom. I started to realize that the more rare skills that I have—whether it be podcasting or programming in Python or things of that nature—that I could actually achieve more personal freedom and financial freedom.When I achieve those things, I have more time for my friends, family, hobbies, and things like this podcast.

Manoj Tandon:
That’s awesome. You know, in yoga there’s an old saying—you might have heard about it—that the mind calms the breath and then the breath masters the mind. Once you’ve mastered the mind, you’ve mastered everything. You’re done.

Ron Eddings:
That is so true. And what I wanted to add to that is there’s also this idea of mystery that is part of my story. I think this is part of many people’s stories in cybersecurity: this wonder of mystery and going on exploration. What I started to realize is the best mysteries and pieces of knowledge are within you. When you look at something like intuition—being able to understand something immediately without having to reason with yourself or go to someone and ask them a question or go to Google—you just get it.

When I’m dancing, I’m doing it intuitively. When I’m thinking about logic, business operations, people, technology, and attack surface, and I have to solve for that attack surface, I think proactively. I don’t have to ask someone how to do this. I think when you look deep down inside, you start to understand and see intuition that’s already within you, whether it’s from nature or education. Then you get to tap into it and start to unravel it. See how the mind, the body, and the spirit work together.

Manoj Tandon:
This is a very powerful thing, and people are probably thinking, “Are we on a cybersecurity podcast or are we on a yoga podcast or some kind of spiritual podcast?” But it’s all interrelated. I don’t think the kind of success that you’ve had, and that you’re trying to propagate to others and enable them to have, just won’t happen if you’re not looking within. It just won’t. I don’t know if you’ve read the book The Alchemist by Paulo Coelho?

Ron Eddings:
I was going to bring that up on this podcast. That’s my favorite book.

Manoj Tandon:
That’s one of my favorites too. There’s one of my favorite lines in that book: “The universe always conspires to help you.” There was a lot of thought put into that. That choice of words is very intelligent—that word “conspires.” I guess you have to create that conspiracy in some ways and be part of it.

Ron Eddings:
Yes. And what the book also talks about is following the omens. Once the universe conspires to help you, you have to take action. You have to start following those signals.

Manoj Tandon:
Trust your intuition, man.

Ron Eddings:
Exactly. And when you see an opportunity, pursue it. That’s that exploration.

Manoj Tandon:
I guess that really is—you have a sense of wonder about you. How do you maintain that for such a long period of time and so consistently? We’ve had so many people on this program. We’ve had laughter yoga coaches, New York Times bestselling authors, hardcore cybersecurity practitioners that get into deep technical detail. But in all cases where we saw a great personality, there was that sense of wonder and it never died. It was something that kept going, and without it, you lose human performance. How do you, on a daily basis, not get bogged down by the happenings and minutia that could derail you and just keep that focus?

Ron Eddings:
There’s a few things. The first element that I would say keeps me inspired and energized is optimism—really looking at the world and your life as glass half full rather than half empty. If I fail a test or certification, which happens quite a bit in cybersecurity whether you’re new or experienced, or if I don’t get a job, I try not to look at it as friction or a problem. I look at it as an opportunity to behave differently and operate differently. That’s the first element that keeps my hunger alive. The second element is journaling. I like to journal every morning. I just started video journaling, which is a little different. When I reflect on all the things I’ve been able to accomplish, I try every now and again to put together a top 10 list—the top 10 things I did this year, the top 10 things I did this month. When I look at that list, I think, “Wow, if I was able to accomplish this in a year or month, what can I do in three months or three years?” How do I start to plan and strategize toward that?

Really, it’s just turned into building a bigger and bigger palace for my skills, my mind, my body, and my family.

Manoj Tandon:
You know, what you’re saying here—there’s actually a lot of research on this. I read voraciously. I read anything I can get my hands on. I love learning new things. One of the topics that there was a lot of medical documentation on is journaling. People who journal and put their thoughts down on paper every day—even if it’s something negative—create distance between themselves and that thought, according to medical science. You ease the tension that may arise from pondering on that thing.

Ron Eddings:
Yes.

Manoj Tandon:
And so it is said. That’s worth the price of admission right there. That’s a tool that everybody listening to this podcast can actually use immediately.

Ron Eddings:
It’s a very powerful tool. You just have to have the discipline to do it.

But then you also have to have the discipline to achieve success. It’s not a one-time event. It’s a continuum of events that you cause.

Manoj Tandon:
So I gotta ask you, what do you think is your superpower? How would you describe it? Because you’re referencing all my favorite books and quotes, so it seems like you’re also on this journey of something similar. I am a lifelong learner. I love learning for the sake of learning and exploring my own limits to see if there are any. I’ve done stupid things like running a marathon, and I definitely didn’t look like this when I did that. I was a lot lighter and probably a little more athletic.

I’ve gained a lot of weight since then. But whether it was running a marathon, getting deeply involved in mathematics, studying aeronautical engineering—which is my background, though I haven’t practiced it in eons—or playing guitar and writing blues music, all those things are completely disparate. Yet by day I’m a cybersecurity practitioner and executive. To me, all those other things enable my success in this role because I’m learning skills and staying engaged with something new every day. There’s always something new. I don’t know anything—that’s the way I look at it. Someone can always teach me something, and I can always learn something.

So yeah, I guess that’s my story.

Ron Eddings:
Well, that was a role reversal there. I’m supposed to be asking the questions, but I’ll answer it. I’m pretty much an open book on this thing.

One of the things that I got engaged with was trying to help underprivileged children get engaged in STEM.

Manoj Tandon:
Okay.

Ron Eddings:
And the idea being, I think a lot of times when we teach topics—and this is actually a question, so we’ll get into this—but a lot of STEM topics, as they are taught today, are overburdening. They really take away that sense of wonder.

Manoj Tandon:
Right.

Ron Eddings:
And if you don’t have that sense of wonder or can’t spark the imagination, the child will not pursue it. So when you, as an example, talk to a high school kid or a middle school kid and ask them, “Do you like math? Do you like science?” a whole bunch of times they’re going to say, “Well, that’s hard.”

Manoj Tandon:
Right.

Ron Eddings:
It’s not hard. That, to me, is the wrong mindset. Whereas if we engage them early, which is what we’re trying to do, and you give them a LEGO robot and don’t give them any instructions—just say, “Here’s some parts. Here’s some things that I made it do. Why don’t you try and make it do something?” No guidance. Just sit there and put things together. ,If that sparks a sense of wonder in them, then everything else will start happening naturally and there’ll be plenty of time later to get into the formalities of JavaScript and Python and all the stuff that’s important. But if we start there, it ain’t going to happen.

Manoj Tandon:
That’s interesting. It makes me also consider the piece of education, which is: how to learn. We only really get to learn how to learn once, if at all. No one has really reached out to me as a student or even as an adult and said, “Hey Ron, I want to assess your learning capacity and ability and then help you get better at learning.” A lot of the times when we look at something like science or technology, we get afraid because of our capacity to learn and remember things. When I got started on this journey of rediscovering myself and reinventing myself, the first thing I did was go back and learn how to learn again. I took this course by a gentleman named Jim Kwik. He has this course called Superbrain. He teaches you how to remember things, how to store a speech in your mind. I started learning things like mnemonics and how to build a memory palace.

And I thought, “My capacity for knowledge is abundant. I just didn’t have the right filing and storage system before really getting my hands and teeth into technology the way I have today.”

Manoj Tandon:
You know, it’s very interesting. Again, I’m going to oversimplify, but it sounds like you’re creating some unstructured mnemonics. You’re creating all these strange images in your mind and associating them to memories. It’s the strangeness of it that keeps the memory alive, right? It makes you recall it. It’s the unstructured nature of it. I always go back to: how does an infant learn? If we look at our children and watch a little child, whether it’s learning to walk or especially learning to talk, a child is not learning commas, periods, adjectives, pronouns, nouns, and verbs. They’re making goo-goo gaga sounds, and then depending on how you respond to them, they’re adjusting themselves.

When we teach that to an adult, what do we do? We start with grammar. If you try to learn a new language, it’s a great example of this. It’s so hard because we’re starting with this highly structured approach, whereas real learning happens in a very unstructured way. You try it. It’s okay to make mistakes, garble something, get a reaction, and then adjust yourself.

Ron Eddings:
Yep. There’s quite a bit that I’m still unpacking about learning. What I think is also worth mentioning is the type of learning that you’re doing. Sometimes maybe it’s through nurture or nature, but sometimes we glance at a book and we can’t focus on it. It’s just like, “I can’t read it.” Or people listening to audiobooks—they just can’t do it. They get bored. Before you know it, they have their phone out or they’re sleeping. Some people, when they’re in person, get shelled up. They can’t be around others and really feel comfortable with learning, let alone performing, solving problems, or taking certifications. I read this other book—we’re talking about a lot of books here—there’s this Harvard Business Review book called Managing Oneself. This book is about how to learn and essentially how to manage yourself if you’re a reader, visual learner, auditory learner, or something else. ,And then surrounding yourself with the right types of people that can help support your learning but also fill in those gaps where you’re not naturally inclined.

Manoj Tandon:
Yeah, we’ll find that book and put it in the show notes. Maybe some folks can go out there and check it out. I guess that comes to this idea of making learning fun. You look at cybersecurity, man, and there’s a whole bunch of cybersecurity podcasts out there. There’s a ton of blogs, white papers, and content. And people are pushing all of this information out there, but it’s dry as hell. How do we get the general public engaged in our industry? When I go to a conference, it’s mostly techies.Where is the average person in this conversation who can make the biggest difference? How do we make this entertaining enough that they’ll say, “Yeah, you know what? I might listen to Ron Eddings over here.” How do you create a culture of cybersecurity or get that into the general population’s mindset?

Ron Eddings:
In my mind, I think I have part of the answer and I want to walk through it with you. Maybe we’ll find some truth or flaws in my answer. What comes to mind first is accessibility. When you think of the word “accessible,” what comes to your mind?

Manoj Tandon:
That I can grab it in two seconds and understand it in two seconds. I put both of those together.

Ron Eddings:
That’s it. Imagine wanting to go read one of these white papers, or even better, your boss assigns you to learn about all the EDR technologies out there.You think, “All right, I need to learn about endpoint detection and response.” So you go to these vendor websites because they should be pioneers on the topic. But the first thing they want you to do is exchange value. You have to enter your email address to access a webinar, ebook, or training. Even when you look at resources like Udemy or Udacity, there’s still a gate there. You have to buy it. I think accessibility is the first thing.

Once we make cybersecurity accessible—where people can access it freely and quickly—then there are a few other things we have to do. We have to make sure the content is fresh. Not fresh from a breaking-news perspective, but fresh in the sense that when you take a bite out of it, it tastes good. When I eat a piece of fruit and it’s spoiled, I spit it out and never eat it again. But if it’s delicious, I keep going back. So it’s through education and entertainment—and when you combine those two together, you get “edutainment.” I think that’s one of the components after accessibility that helps bring more and more people in. There is one other thing I have to mention though, and I know you work on this with your company and your podcast, and that’s the youth. We can’t make a change without affecting the youth.

We have a tremendous number of programs that help people get into college programs, degree programs, scholarships, and certifications. But what about making it accessible? People still have to know these things exist. You often have to know someone to really get your start in cybersecurity today. If we spoke to the young—I’m talking elementary school age—that’s when kids have this appetite to learn and they can do it so quickly. The older we get, the more stubborn we become. We start developing habits and lose curiosity. And for that younger crowd, it better really be fresh. It better be fun. If we start elementary kids off with the CCNA, good luck. Let’s see what happens.

Manoj Tandon:
So let me ask you about Hacker Valley Studios. Is that part of your mission—to make things accessible and bring infotainment into this space? What’s going on there?

Ron Eddings:
Yeah, that’s exactly part of our mission. Our mission, in simple words, is to explore the intersection between cybersecurity, technology, and humanity. While we’re doing this—and why we’re doing this—we created the goal of producing astonishing content. Content that’s fresh, but also content that’s good for people. People inside cybersecurity and people outside cybersecurity. You may work in the industry or you may not, but that doesn’t mean there’s nothing to learn. There’s always something to learn, and that’s what we hope to provide: something for people to learn from and enjoy.

Manoj Tandon:
That’s fantastic. I’ll have to check out some of the content up there because, again, it’s such a dry topic sometimes. I look at some of these things and think, “Man, I might just fall asleep trying to get through this.” Give me something that’s fun. One thing that I often see is that we have this focus on technology, but you mentioned humanity. And part of that humanity framework, to me, is the hacker’s psychology themselves.

There is no school that I know of—other than U.S. Cyber Command, they’re the only ones that really do this—that talks about the psychology behind hacking, to know your adversary. I sit on the board at Slippery Rock University, and I’ve been trying to get those guys to introduce this into their computer science department. For kids who want to get into cyber, you have to teach them about the adversary. Learn about the human aspects of it. How do you socially engineer something? How do I make it so delightful that you want to take a bite out of my fruit when I want to do something bad to you? I think those would be hilarious topics to explore. They could be done in a fun way, and they might educate a lot of people on how things go south.

Ron Eddings:
Both are important.

Manoj Tandon:
Right. So I look forward to seeing a lot more content there from you guys. And if you want us to share some of the stuff—tweet it out or put it on Instagram—we’ll make sure that we push it out to our audience as well.

Ron Eddings:
Thank you.

Manoj Tandon:
So let’s go to… man, we are running out of time. There’s no way we’re getting through all this. Let’s go to the most basic—and perhaps dumbest—question in the world: what is the value of cybersecurity? Who cares?

Ron Eddings:
That is a question that many people are asking themselves, whether it’s from a positive perspective and trying to provide more value, or from a negative perspective and just being annoyed by cybersecurity teams and leaders. Like, “What are they trying to do to my work and productivity?” But the value of cybersecurity is pretty simple in my mind: it’s to provide security for technology. Anything cyber-related. Cyber could be a server, laptop, or IoT resource.

But we’re starting to see that this term “cybersecurity” is very vast. It’s hard to simply say, “I work in cybersecurity,” versus saying, “I work in incident response” or “vulnerability management.” Because how can we really “do cybersecurity”? That’s a question I don’t think anyone has fully solved yet. Otherwise there would be one company out there with all the customers and all the answers. Cybersecurity can help secure your technology and provide opportunities for your teams to be productive and collaborate freely. We don’t always see that, and sometimes we actually see the opposite. But cybersecurity can help business operations succeed when the teams and leaders really understand communication and collaboration. That’s very rare. I’ve only worked at a few organizations where the leaders and teams truly understood business operations. We could make a lot of money as a company if we helped the business optimize, scale, and succeed. But I think something is missing in our mindset when we’re learning or being mentored while breaking into cybersecurity.

Manoj Tandon:
Isn’t that a two-way street, though? Because there’s something broken on our side, but when you look at the executive side of the house—the business leaders—they still think cyber is just a technology-based conversation. There’s this mentality of, “What’s the new silver bullet of the day?”

Ron Eddings:
They really do. And it wasn’t until around 2015 that I started seeing how security could truly help business operations scale and succeed. That was when I started seeing AppSec engineers—engineers that really understood the code and the application itself. Because they have to work with so many teams to get things right.

They have to work with stakeholders who have the idea for the application. They have to work with developers when flaws are discovered. They also have to work with customers to help remediate issues.It’s such a balancing act that you have no choice but to start understanding how to help people succeed. When you learn that your job won’t be successful if someone else’s job isn’t successful, you start helping them. Before that, when we just had analysts sitting in SOCs that didn’t understand the organization, I couldn’t see how they could help the business scale if they didn’t understand the culture, workflows, and employee pain points.

Manoj Tandon:
I couldn’t agree with you more. Before I go down another rabbit hole, do you have an example where the security team enabled the business to scale successfully?

Ron Eddings:
Vulnerability management is always a great example in my mind because there are so many areas where you can help the business. One obvious area is eliminating vulnerabilities, but another is misconfiguration. You can identify flaws in how users operate applications.

Sometimes employees encounter bugs and just work around them without telling anyone. Security teams can help identify where configurations aren’t aligned with policy or organizational practices. And when you’re looking at vulnerability management helping the organization, there’s also the idea of cost savings. Once you get a lay of the land—and you talked earlier about “know thy enemy”—it’s also about “know thyself.” Understanding all the assets you have within your environment and being able to say, “What’s all here?” Whether it’s laptops, SaaS applications, or cloud infrastructure.

Imagine if you knew all the SaaS applications you had and how much they cost each year. You could say, “Ron hasn’t logged into this application in a year, along with 30 other people. We could save money by removing those seats or renegotiating the licensing.” Security can help with those types of operational efficiencies, and I think that’s just scratching the surface.

Manoj Tandon:
Oh yeah, I’ll throw one out there. We worked with a major retailer and used Identity and Access Management to consolidate loyalty programs across all their brands. So if you shop at Store A, you create an identity. You shop at Store B, you create another identity. But they’re actually the same person. They didn’t know those were the same people. When you consolidate those identities, you can track purchasing behavior across brands. Now you know what they buy, and if you know what they buy, you know what to sell to them. Now you’ve gone from a cost center to a revenue center.

Ron Eddings:
Yes. There’s another thing I just thought of that makes security fun. One application that comes to mind is Okta. Everyone I’ve ever heard talk about Okta has been positive. People say, “Hey, let me get you added to Okta for that app. Let me make sure you get the right permissions.” And suddenly everything starts coming together and you feel good—not just because you have access to your applications, but because you don’t have another password to remember. Passwords have always been the bane of our existence. I still want multifactor authentication, but I don’t want the password part. So I think Okta really made security enjoyable by simplifying access management.

Manoj Tandon:
That’s a cool point. We do a lot of work with them, so I’ve done all kinds of interesting projects with those guys. I’m going to skip some questions here because we’re not going to get through all this. I hope at some point we’re able to get you back and go deeper into some of these topics. But one thing I know our audience would love to know is this: Between the InfoSec programs you’ve seen that worked and the ones that were really terrible, what differentiated them? What separated the good programs from the bad ones?

Ron Eddings:
Yeah, I have a few examples that come to mind. I’ll mention both a strategic gap and a tactical gap. Starting with the tactical side, one of the biggest gaps I see is not understanding why you’re doing something. Many security practitioners I’ve worked with come from big-name companies where they learned certain methods and processes. Then they go to another organization and think, “I’ll just do the exact same thing here.” But they don’t understand how the business works. What are the requirements? Why is the application deployed in a certain environment? Who does it serve?

If your work as a security analyst or engineer only serves yourself, that can become a huge problem. That can lead to layoffs, stakeholders not understanding security’s value, and executives eventually asking, “Why is cybersecurity important? Who cares?” The strategic issue I see most often is culture. Organizations lacking the right culture. Different personalities not aligning. No shared mission or vision. When organizations clearly define their mission, vision, and values, everyone has a North Star. People understand the bigger picture. The vision helps people stay aligned with both themselves and the organization, and the values define how everyone moves toward those goals together. When organizations have that clarity—from the company level down to the team level—people know what direction to move in. There will still be problems and challenges, but at least everyone is marching together. That culture of security is really the people-and-process side of the equation.

Manoj Tandon:
So maybe the question should be—instead of framing it as, “What’s the value of cybersecurity?”—should we better frame it as, “What is the value of Information Security?” because that now includes people and process into this, which is typically left out of the equation.Not always, but a lot of times that omission causes you to lack that culture of security, right? Tell me if I’m wrong.

Ron Eddings:
That’s a great assessment and question because we would like cybersecurity teams or Information Security teams to be able to help with everything.But if a process has a flaw—a flaw that’s introduced outside of the technology itself—I think it’s part of the responsibility of the security team to help remediate and resolve it, but it’s still a group effort. Organizations that do security well don’t put everything on the security team alone to make determinations and create policies. It’s a collaborative effort.Especially during incidents and alerts. I’ve worked as a consultant with organizations where the person maintaining the application is on the call during an incident. The person helping customers from a support perspective is also on the call because they’re able to identify suspicious activity. How would a security team member know that a storefront web application is experiencing suspicious activity outside of the standard brute-force indicators? Understanding user patterns and behaviors—that’s what the application stakeholder understands deeply and can help articulate to the security team. Having that tribe to help raise the tide is what I’ve found to be successful for security programs and teams.

Manoj Tandon:
What about security teams that are really just cops and are always saying “no”? Is that not a disabler to that culture of security?

Ron Eddings:
It is, and it’s also an enabler for Shadow IT. Those days are numbered. We’re getting to a point in society, especially through digital transformation, where we don’t have the level of control we used to. We’re not always working out of office buildings anymore. Sometimes we’re not even using corporate laptops to access business-critical processes or sensitive data. And when you look at the sprawl of SaaS applications, it becomes even more complicated. My Slack has access to Zoom. Slack also has access to Google Drive. Then what has access to Google Drive? That level of interconnected sprawl makes it almost impossible for security teams to remain the “Department of No.” Those days are numbered, and we have to find ways to start saying, “Yes,” or at least, “Yes, but…”

Manoj Tandon:
I love it. We are running out of time here, and I wanted to give you the floor for the last couple minutes to plug anything you’d like. Anything coming up? Talks, books, podcasts—what’s going on that you’d like our audience to know about?

Ron Eddings:
Yeah, we’ve got a lot of things going on. The easiest place to check everything out is hackervalley.com. We have 10 shows at the moment and we push out shows multiple times a week. We have shows ranging from the intersection of technology and humanity—like we talked about with Hacker Valley Studios—all the way to Hacker Valley Red and Blue, which explores the mindset and capabilities of offensive and defensive practitioners. We also launched a newer show called Technically Divided about five months ago. That show explores the most divisive topics in technology and cybersecurity. But even though we say we’re divided, ultimately we’re all on one team. And the last resource I’d highly recommend everyone check out—especially if you want to work with me on a technology or architectural level—is Axonius. I work for Axonius as a Creative Director. I work hand-in-hand with the sales team, sales engineering team, product team, and product marketing team. I marry all that information together to make sure that everyone has access to understandable information about asset management because that is the first pillar of cybersecurity. Do not pass go. Do not collect $200 until you understand your asset inventory because how can you protect what you can’t see?

Manoj Tandon:
Well, that’s the obvious, but it’s not so fast. It’s a dark rhino.

Ron Eddings:
It is, man. It really is.

Manoj Tandon:
Hey, we love our rhinos, man. They’re good. But with that, Ron, really appreciate you being on the show. It was really a privilege and an honor to have you here. Thanks for doing this. And don’t be a stranger. When you’ve got something new going on out there, feel free to come on. We’d love to share it.

Ron Eddings:
Love it. Likewise, the door is always open. Can’t wait to have you on ours.

Manoj Tandon:
I look forward to it. Thank you very much. Take care, everybody.